IndicatorPublished 24 Aug 2025Updated 25 Aug 2025

type osint · ThreatFox IOCs for 2025-08-24

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 76

easydirectpdf.comUnknown malware payload delivery domain (confidence level: 100%)
pdf-working.comUnknown malware payload delivery domain (confidence level: 100%)
manualsfc.comUnknown malware payload delivery domain (confidence level: 100%)
ascenti-stage.fiora.agencyUnknown malware payload delivery domain (confidence level: 100%)
astrologyappsuite.comUnknown malware payload delivery domain (confidence level: 100%)
converterbyonestart.comUnknown malware payload delivery domain (confidence level: 100%)
convertwithonestart.comUnknown malware payload delivery domain (confidence level: 100%)
foundpdf.comUnknown malware payload delivery domain (confidence level: 100%)
justconvertpdf.comUnknown malware payload delivery domain (confidence level: 100%)
launchpdfplus.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 12

https://116.203.115.180Vidar botnet C2 (confidence level: 75%)
https://dlp.socialsalesnaija.comVidar botnet C2 (confidence level: 75%)
http://104.225.234.132:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://freaks.icuStealc botnet C2 (confidence level: 100%)
https://debuqda.top/xkapLumma Stealer botnet C2 (confidence level: 100%)
https://gate.socialsalesnaija.comVidar botnet C2 (confidence level: 75%)
https://fruitroot.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)
http://chimerasound.shopStealc botnet C2 (confidence level: 100%)
http://meta-mim.in/wp-includes/js/pzy/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://f1159963.xsph.ru/a6fd09fa.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 115

161.97.77.188Mirai botnet C2 server (confidence level: 75%)
87.248.130.35Mirai botnet C2 server (confidence level: 100%)
82.27.2.83Mirai botnet C2 server (confidence level: 100%)
84.200.81.239Mirai botnet C2 server (confidence level: 100%)
213.232.114.169Mirai botnet C2 server (confidence level: 100%)
196.251.84.79Mirai botnet C2 server (confidence level: 100%)
213.209.150.159Mirai botnet C2 server (confidence level: 100%)
103.191.63.195Mirai botnet C2 server (confidence level: 100%)
176.65.149.225Bashlite botnet C2 server (confidence level: 100%)
144.172.108.160Remcos botnet C2 server (confidence level: 100%)

Hashes 192

6a2f992055737bd58e936c01c86ed965034dce57XWorm payload (confidence level: 95%)
d95b28a388740e01832e83fccfb6eb8b07188c36ffdcc5d73fa9d00754946459XWorm payload (confidence level: 95%)
4489cbaa5dc8e45ad3293280175bda02XWorm payload (confidence level: 95%)
a155128f728206ab6a2d1a521cb8ae8353ce8e4dQuasar RAT payload (confidence level: 95%)
0ae8c5022567fc8588fdc2fbf27d1d245f7e9bb15a23cb8a01962be6b51cb73cQuasar RAT payload (confidence level: 95%)
dc104d73061e9885e79df21521cb6e17Quasar RAT payload (confidence level: 95%)
c0f9722893b577d7ae9685b6bdcc3397b2d76d31Nanocore RAT payload (confidence level: 95%)
aa4adbda7daad239a268c41c7735506d3fa7e65eceed44c72f4970696b68dbefNanocore RAT payload (confidence level: 95%)
d41699557c343de406b656f5d5d61766Nanocore RAT payload (confidence level: 95%)
7e0feb09724f2374998c039c321bbdf54cbd201aCoinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-24

Impact

For European organizations, the impact of this threat is currently limited due to the lack of known active exploits or specific affected products. However, the presence of updated IOCs related to malware payload delivery means that organizations could face increased detection opportunities for malicious network activity if these IOCs are integrated into security monitoring tools. Failure to incorporate such intelligence could result in delayed detection of malware infections or network intrusions. Given the medium severity, the threat could potentially facilitate initial access or lateral movement if leveraged by threat actors, but without concrete exploit details or active campaigns, the immediate risk remains moderate. Organizations with mature security operations centers (SOCs) and threat hunting capabilities can benefit from integrating these IOCs to enhance their detection capabilities. Conversely, less mature organizations may not see immediate benefit but should remain vigilant. The lack of patches or fixes indicates that this is not a vulnerability but rather threat intelligence data, so the impact is primarily on detection and response effectiveness rather than direct exploitation consequences.

Defensive guidance

1. Integrate the provided IOCs into existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular threat hunting exercises using these updated IOCs to proactively identify potential infections or compromise within the network. 3. Maintain up-to-date network segmentation and monitoring to limit the spread of malware if detected. 4. Ensure that incident response teams are aware of these IOCs and have procedures in place to investigate alerts triggered by them. 5. Continuously update and tune detection rules to reduce false positives while maintaining sensitivity to relevant threat activity. 6. Educate network and security personnel about the nature of OSINT-based threat intelligence to improve contextual understanding and response prioritization. 7. Since no patches are available, focus on strengthening detection and containment rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…